Transnational carding networks are organized cybercriminal groups that specialize in stealing bank card data, selling it on darknet markets, and then using it for fraudulent activities, including purchases, cashouts, and money laundering. These networks operate across borders, often coordinating their activities between countries with varying levels of regulation (e.g., Russia, the United States, China, India, and countries in Southeast Asia). International sanctions imposed by organizations such as OFAC (Office of Foreign Assets Control, United States), the EU, the UN, and national governments significantly influence their activities. For educational purposes, I will examine the mechanisms of this influence, including financial, technological, organizational, and geopolitical aspects, and provide examples and potential long-term consequences.
If you'd like to dive deeper into a specific aspect (like the role of cryptocurrencies or 2025 case studies), let me know!
1. Financial constraints: a blow to monetization
Carding networks depend on the ability to quickly monetize stolen card data through purchases, transfers, or cash withdrawals. International sanctions create significant barriers to this chain:- Blocking of payment systems. Following the imposition of sanctions against Russia in 2022, Visa, Mastercard, and American Express suspended operations with Russian banks outside the country. This limited the ability of carders based in Russia to conduct cross-border transactions. For example, using stolen cards for purchases in Western online stores became more difficult due to geolocation checks and payment processing denials. According to cybersecurity analysts, the volume of successful transactions by Russian carders fell by 25-30% in 2022-2023.
- SWIFT and bank transfer restrictions. Sanctions that exclude banks from the SWIFT system (for example, Russian banks in 2022 or Iranian banks earlier) complicate international money laundering transfers. Carders using "money mules" (intermediaries who cash out funds) face account freezes or delays, increasing risks and reducing profitability.
- Pressure on cryptocurrency platforms. Many carding networks have switched to cryptocurrencies (Bitcoin, Monero) for anonymity. However, sanctions against crypto exchanges such as Garantex (Russia, 2022) and Huione Group (Cambodia, 2024) limit the ability to convert crypto into fiat. For example, in 2024, the US imposed sanctions on Huione for laundering $150 million, some of which was related to carding. This forces networks to seek less reliable platforms, increasing the risk of fraud on the darknet.
- Consequences. Financial sanctions reduce transaction liquidity, increase intermediary costs, and heighten the risk of losses. Group-IB estimates that the global market for stolen card data will lose up to 20% of its value in 2023 due to sanctions restrictions.
2. Targeted sanctions against key figures and infrastructure
Sanctions targeting specific individuals or organizations involved in cybercrime target carding networks:- OFAC's Transnational Criminal Organizations (TCO) Program. The US actively sanctioned administrators of darknet markets and carding forums. In 2024, OFAC imposed sanctions against Timur Shakhmametov, the alleged administrator of Joker's Stash, one of the largest markets for stolen cards. This resulted in the freezing of his assets, the blocking of associated crypto wallets, and the closure of the platform. A $10 million reward for information on him demonstrated that authorities were willing to invest resources in eliminating its leaders.
- Marketplace closures. Sanctions and subsequent international operations (e.g., by Europol and the FBI) lead to the seizure of servers and domains. An example is the 2022 closure of SSNDOB, which sold card data and personal information. In 2025, similar actions were taken against Asian platforms such as Genesis Market, reducing access to data "packages" (fullz).
- Effect on participants. Targeted sanctions create a "fear effect," forcing smaller participants (such as intermediaries or newcomers) to leave the market due to the risk of arrest or financial losses. This leads to consolidation: major players strengthen their positions, but the overall volume of transactions declines.
3. Technological and infrastructural barriers
Carding networks rely on technological infrastructure: servers, VPNs, hosting providers, and anonymity networks (Tor). Sanctions complicate access to these resources:- Western ISPs Withdrew. In 2022, Cogent and Lumen, major internet service providers, ceased operations in Russia due to sanctions. This disrupted the servers used to store carding databases or coordinate attacks. Carders were forced to migrate to local or Asian platforms, which are less reliable and more susceptible to attacks from competitors.
- Pressure on VPNs and hosting. Sanctions against companies providing anonymity services (such as Russian VPNs) limit carders' ability to remain hidden. In 2024, the EU introduced measures against hosting providers associated with darknet markets, forcing networks to relocate to jurisdictions with less regulation (such as Southeast Asia or Africa).
- Cyberattacks and vulnerabilities. Relocating infrastructure to less secure regions makes networks vulnerable to attacks by competitors or law enforcement. For example, in 2025, raids on local servers hosting carding forums in Cambodia resulted in a data leak and arrests.
4. Geopolitical and organizational changes
The sanctions affect not only technical aspects, but also the structure and geography of carding networks:- Migration to "gray zones." Sanctions are forcing networks to relocate to countries with lax regulations, such as Cambodia, Thailand, Nigeria, and India. However, these regions are becoming targets for international operations. For example, in 2025, Interpol and the US conducted joint raids in Southeast Asia, arresting dozens of participants linked to money laundering through carding.
- Rise in local fraud. In sanctioned countries (e.g., Russia, Iran), carders are shifting their focus to domestic markets. This leads to an increase in local fraud but reduces global profits, as domestic markets are less profitable. According to Flashpoint, local fraud volume in Russia will increase by 15% in 2023, but transnational operations will fall by 25%.
- Market consolidation. Sanctions raise barriers to entry for newcomers, as access to global instruments (crypto exchanges, payment gateways) is limited. This strengthens the position of large networks like AllWorld Cards, but reduces the overall market size.
5. Adaptation of carding networks and new challenges
Despite the pressure, carding networks are adapting, but sanctions are limiting their effectiveness:- Shifting to cryptocurrency. Carders use Monero or anonymous wallets, but sanctions against exchanges (such as Tornado Cash in 2022) complicate conversion. In 2025, the US tightened monitoring of blockchain transactions, increasing the risk to networks.
- Use of AI and automation. Carders use AI to automate attacks (such as brute-force or phishing), but sanctions on access to cloud services (AWS, Azure) limit their capabilities. In 2024, Microsoft and Google tightened checks on clients from sanctioned countries.
- Local payment systems. In Russia, carders try to use SPFS (an alternative to SWIFT) or Mir cards, but their international use is limited. This forces networks to seek workarounds through intermediaries in friendly countries (e.g., Kazakhstan, the UAE).
6. Long-term consequences
Sanctions strike a difficult balance: they weaken transnational networks without completely destroying them. The main effects are:- Declining Scale. Chainalysis estimates that global darknet market turnover, including carding, will decline by 15–20% by 2024 due to sanctions and law enforcement operations.
- Strengthening international cooperation. Sanctions are coordinated with Europol, Interpol, and the FBI, increasing arrests. In 2025, joint US-India efforts led to the arrest of over 50 network members in Mumbai.
- The evolution of fraud. Carders are moving to new schemes, such as attacks on digital wallets (PayPal, Revolut) or using stolen data for blackmail (ransomware). However, sanctions on the financial infrastructure are limiting their scalability.
Examples and data
| Event | Year | Impact on carding networks | Source |
|---|---|---|---|
| Sanctions against Russian banks | 2022 | Visa/Mastercard blocking, cross-border transactions fall by 25% | Group-IB |
| Sanctions against Joker's Stash | 2024 | Platform closure, asset freezing | OFAC |
| Raids in Cambodia | 2025 | Arrests, seizure of servers | Interpol |
| Sanctions against Huione Group | 2024 | Freezing of $150 million linked to money laundering | Chainalysis |
Recommendations for educational purposes
- Studying cybersecurity. Sanctions highlight the importance of monitoring blockchain transactions and cooperation between countries. Students should explore analysis tools such as Chainalysis Reactor or Elliptic.
- Understanding the Darknet. Carding networks are part of the darknet ecosystem. Analyzing forums (for example, through Flashpoint or Recorded Future) helps understand their adaptation.
- Political context. Sanctions are not only an economic tool but also part of a geopolitical struggle. Studying their impact on cybercrime requires an interdisciplinary approach (law, economics, IT).
If you'd like to dive deeper into a specific aspect (like the role of cryptocurrencies or 2025 case studies), let me know!